Data Processing Agreement

This Data Processing Agreement ("DPA") supplements the Infrarails Terms of Service ("Agreement") between Infrarails AI Labs Private Limited ("Infrarails," "we," or "Processor") and the customer organization that has accepted the Agreement ("Customer," "you," or "Controller").

This DPA reflects the parties' agreement on the processing of Personal Data by Infrarails on behalf of Customer in connection with the Infrarails platform ("Services"). It is intended to comply with Article 28 of the EU General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR"), the UK GDPR, and equivalent data-protection laws of other applicable jurisdictions.

Where this DPA conflicts with the Agreement, this DPA controls in respect of Personal Data processing.

1. Definitions

Capitalized terms not defined in this DPA have the meaning given to them in the Agreement or in applicable Data Protection Laws. The following terms have the meanings set out below:

• "Customer Personal Data" means Personal Data that Infrarails processes on behalf of Customer in connection with the Services.
• "Data Protection Laws" means all laws and regulations applicable to the processing of Personal Data under the Agreement, including the GDPR, UK GDPR, the California Consumer Privacy Act ("CCPA"), the Digital Personal Data Protection Act 2023 (India, "DPDPA"), and the Health Insurance Portability and Accountability Act of 1996 ("HIPAA") where applicable to the engagement.
• "Personal Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data.
• "Sub-processor" means any third party engaged by Infrarails to process Customer Personal Data on Customer's behalf.
• "Standard Contractual Clauses" or "SCCs" means the standard contractual clauses for the transfer of Personal Data to third countries adopted by the European Commission (Decision 2021/914) or equivalent transfer mechanisms recognized under UK or other applicable law.

2. Scope and Roles

Customer is the Controller and Infrarails is the Processor in respect of Customer Personal Data, unless Customer is itself a processor for an upstream controller, in which case Infrarails acts as a sub-processor and the same protections apply.

Subject matter, duration, nature, and purpose of processing, the type of Personal Data, and categories of Data Subjects are described in Annex I.

3. Customer Obligations

Customer warrants that:

• It has a valid lawful basis for the processing instructed under the Agreement;
• Its instructions to Infrarails comply with Data Protection Laws;
• It has provided all required notices to Data Subjects and obtained any consents required for the processing; and
• It will not use the Services to process special categories of Personal Data (Article 9 GDPR), Personal Data of children under 16, or Protected Health Information (HIPAA) until the parties have signed any required additional terms (e.g., a HIPAA Business Associate Agreement).

4. Infrarails Processor Obligations

Infrarails will:

• 4.1 Documented Instructions. Process Customer Personal Data only on Customer's documented instructions, including with respect to international transfers, unless required to do otherwise by Union or Member State law to which Infrarails is subject. Infrarails will inform Customer of any such legal requirement before processing, unless that law prohibits such notice on important grounds of public interest.
• 4.2 Confidentiality. Ensure that personnel authorized to process Customer Personal Data are bound by written confidentiality obligations or are under an appropriate statutory obligation of confidentiality.
• 4.3 Security. Implement and maintain the technical and organizational measures ("TOMs") described in Annex II, designed to ensure a level of security appropriate to the risk.
• 4.4 Sub-processors. Engage Sub-processors only in accordance with Section 5 below.
• 4.5 Data Subject Requests. Taking into account the nature of the processing, assist Customer by appropriate technical and organizational measures, insofar as possible, in fulfilling Customer's obligations to respond to requests for the exercise of Data Subject rights (Articles 12–22 GDPR).
• 4.6 Compliance Assistance. Assist Customer in ensuring compliance with the obligations under Articles 32 to 36 GDPR (security, breach notification, DPIA, prior consultation), taking into account the nature of the processing and the information available to Infrarails.
• 4.7 Return or Deletion. At Customer's choice, delete or return all Customer Personal Data to Customer after the end of the provision of the Services, and delete existing copies, unless Union or Member State law requires storage.
• 4.8 Audit Cooperation. Make available to Customer all information necessary to demonstrate compliance with this DPA and allow for and contribute to audits, in accordance with Section 9 below.

5. Sub-processors

5.1 General Authorization. Customer provides general written authorization for Infrarails to engage the Sub-processors listed in Annex III to process Customer Personal Data, on the condition that the obligations set out in this Section apply.

5.2 Notice of Changes. Infrarails will inform Customer of any intended addition or replacement of Sub-processors at least thirty (30) days before such Sub-processor begins processing Customer Personal Data, by updating the list at Annex III and notifying Customer via the Customer's registered contact email or in-app notification.

5.3 Right to Object. Customer may object on reasonable grounds related to data protection within fifteen (15) days of notice. If the parties cannot agree on a resolution, Customer may terminate the affected portion of the Services without penalty as Customer's sole and exclusive remedy.

5.4 Sub-processor Obligations. Infrarails will impose data-protection terms on each Sub-processor that are no less protective than those set out in this DPA. Infrarails remains liable to Customer for the performance of each Sub-processor.

6. International Transfers

Where Infrarails or any Sub-processor processes Customer Personal Data outside the European Economic Area, the United Kingdom, or any other jurisdiction whose laws restrict transfer, the parties will rely on:

• An adequacy decision under Article 45 GDPR (or equivalent), where applicable; or
• The Standard Contractual Clauses, which are incorporated by reference into this DPA. The parties will deem to have signed Module Two (controller-to-processor) of the SCCs, with the optional clauses on docking, audits, and sub-processor changes selected; UK and Swiss addenda apply where relevant; or
• Any other transfer mechanism recognized under applicable Data Protection Laws.

7. Personal Data Breach Notification

Infrarails will notify Customer without undue delay, and in any event within seventy-two (72) hours, after becoming aware of a Personal Data Breach affecting Customer Personal Data. The notification will include, to the extent then known:

• A description of the nature of the breach, including categories and approximate number of Data Subjects and records concerned;
• The name and contact details of Infrarails's contact for further information;
• The likely consequences of the breach; and
• Measures taken or proposed to address the breach, including measures to mitigate adverse effects.

Infrarails will reasonably cooperate with Customer in Customer's investigation and notification obligations under Articles 33 and 34 GDPR.

8. Data Subject Rights

Infrarails will, to the extent legally permitted, promptly notify Customer of any request received directly from a Data Subject in respect of Customer Personal Data. Infrarails will not respond to such requests except on Customer's documented instructions or as required by applicable law. Infrarails will provide Customer with reasonable assistance, taking into account the nature of the processing, to enable Customer to respond to Data Subject requests.

9. Audits and Inspections

9.1 Documentation. Infrarails will make available to Customer a copy of Infrarails's most recent third-party security certifications (e.g., SOC 2, ISO 27001) and audit reports as they become available, together with the security documentation made available through the Services, on Customer's reasonable written request.

9.2 On-site Audits. Customer may conduct on-site audits no more than once per twelve (12) month period (or more frequently if required by a competent supervisory authority or following a Personal Data Breach), upon thirty (30) days' prior written notice and subject to mutually agreed scope, confidentiality, and security restrictions. Customer bears its own audit costs; Infrarails bears its own cooperation costs unless the audit reveals Infrarails's material non-compliance, in which case Infrarails bears Customer's reasonable audit costs.

9.3 Auditor. Customer may use a mutually-acceptable independent third-party auditor that is not a competitor of Infrarails and that signs a confidentiality undertaking in a form reasonably acceptable to Infrarails.

10. Liability

Each party's liability under this DPA is subject to the limitations of liability set out in the Agreement. Nothing in this DPA limits or excludes any liability that cannot be limited or excluded under applicable law.

11. Term and Termination

This DPA takes effect on the date Customer accepts the Agreement and continues until the Agreement terminates. Sections that by their nature should survive termination (including Sections 4.7, 7, 9, and 10) survive termination.

12. Governing Law

This DPA is governed by the same governing law and jurisdiction set out in the Agreement, except where Data Protection Laws require otherwise (in which case the laws of the Customer's jurisdiction of establishment apply to this DPA only).